Thanks to Joey and Chris for responding. Joey had said >Jump through the hoop of rebuilding the keystore with the current java > I believe this is what we did that made the difference I am not > familiar with PKCS11 > we use Http11Nio2Protocol with PKCS12 for complete chain bundling.
Chris had some questions about my PKCS11 setup, but I'm taking a left turn and changing to PKCS12, since java.security now has fips.keystore.type=pkcs12 and this community seems to know more about it. So I changed back to using PKCS12. I recreated the keystore from my key and signed cert using openssl and switched to using Http11Nio2Protocol. Now the connector is this: <Connector port="8843" protocol="org.apache.coyote.http11.Http11Nio2Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" server="Apache" keyAlias="tomcat9" keystorePass="XXXXXXXXXXXXXX" keystoreType="PKCS12" keystoreFile="<path>/tomcat9.p12" maxHttpHeaderSize="32768" sslEnabledProtocols="TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" clientAuth="false" sslProtocol="TLSv1.2"/> This produced the following error: 16-Nov-2022 14:54:58.858 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector[org.apache.coyote.http11.Http11Nio2Protocol-8843]] org.apache.catalina.LifecycleException: Protocol handler initialization failed at org.apache.catalina.connector.Connector.initInternal(Connector.java:1051) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.core.StandardService.initInternal(StandardService.java:556) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1045) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.startup.Catalina.load(Catalina.java:724) at org.apache.catalina.startup.Catalina.load(Catalina.java:746) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:305) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:475) Caused by: java.lang.IllegalArgumentException: keystore password was incorrect at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:107) at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71) at org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:145) at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1227) at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1240) at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:606) at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:77) at org.apache.catalina.connector.Connector.initInternal(Connector.java:1048) ... 13 more Caused by: java.io.IOException: keystore password was incorrect at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2159) at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:221) at java.base/java.security.KeyStore.load(KeyStore.java:1473) at org.apache.tomcat.util.security.KeyStoreUtil.load(KeyStoreUtil.java:67) at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:217) at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:207) at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:283) at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:247) at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:105) ... 20 more Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: java.security.NoSuchAlgorithmException: Cannot find any provider supporting PBEWithSHA1AndDESede ... 29 more 16-Nov-2022 14:54:58.860 INFO [main] org.apache.catalina.startup.Catalina.load Server initialization in [6240] milliseconds I am sure I am using the correct password, having created the keystore moments before this, so I assume the issue is with PBEWithSHA1AndDESede. And now I'm in over my head...any advice? Thanks so much, Angela -----Original Message----- From: Christopher Schultz <ch...@christopherschultz.net> Sent: Tuesday, November 15, 2022 21:50 To: users@tomcat.apache.org Subject: Re: tomcat and FIPS - PKCS11 CKR_SESSION_READ_ONLY error after OpenJDK upgrade Angela, On 11/14/22 11:56, Cantor, Angela T. wrote: > We just upgraded OpenJDK from 17.0.4.0.8-2.el8_6 to the above version. Now > tomcat won't listen on the desired port. Something is wonky with it > accessing the keystore. If you all see anything obvious, could you please > advise? Especially if it involves switching to a pkcs12 keystore (which I > tried but that also failed - I am no expert on setting up either type so > maybe I did something wrong.) Nothing other than the OpenJDK version seems > to matter - if we downgrade it back to 17.0.4.0.8, tomcat once again works > fine. Note that 17.0.4.1.1-2.el8_6 also caused the same problem. > > [snip] > certificateKeystoreProvider="SunPKCS11-NSS-FIPS" Could this be the problem? Does your new Java version have that security provider available? I have some code which can dump-out the available providers if you aren't sure. > certificateKeystoreType="PKCS11" This also looks weird to me: PKCS11 is an API, not a file type. But maybe you have to use this in order to access a keystore via the OpenSSL API? It makes some sense since you haven't specified a filename for the keystore. I don't have any experience with that. :/ -chris --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org